wmr

wmr model hub

This repository hosts the models wmr downloads for its SynthID regeneration (--synthid-attack regen). wmr is a command-line tool that removes visible watermarks from Gemini / Veo / NotebookLM generated media and scrubs the invisible SynthID watermark via lossy SDXL img2img regeneration (the only SynthID attack the published literature reports as validated, confirmed here against Google's official SynthID verifier).

wmr auto-downloads the files it needs on first use and caches them under ~/.cache/wmr/; you do not need to download anything from here manually. Pass --regen-no-download to refuse the network. The SHA256 of every file is pinned in wmr's source and verified after download. On upgrade, wmr re-verifies each cached file against its pin and re-downloads only what changed, removing the old copy first (the cache does not grow).

There are two regeneration backends, each with its own model set:

1. CoreML SDXL (macOS Apple Silicon)

Used by --synthid-attack regen on macOS Apple Silicon (the default there). Native CoreML .mlpackage directories converted from apple/ml-stable-diffusion tag 1.1.1, tarred for hosting.

The UNet + VAE are converted from Stability AI's SDXL base 1.0 + madebyollin/sdxl-vae-fp16-fix. The empty-prompt embeddings are pre-baked CLIP outputs (the text encoders are not shipped).

Attention implementation: ORIGINAL

The UNet is converted with --attention-implementation ORIGINAL. apple/ml-stable-diffusion offers two attention implementations for the converted UNet:

• ORIGINAL (used here): the native scaled-dot-product attention. CoreML places it on the GPU under the default compute units.
• SPLIT_EINSUM: an Apple-specific recast that splits attention into multiple einsum operations, designed for the Neural Engine (ANE). For SDXL it does not actually run on the ANE (the large attention matmuls are ANE-ineligible), so it runs on the GPU too, slightly slower per step than ORIGINAL.

ORIGINAL is the faster of the two on the GPU (the ANE is unused by both for SDXL). wmr's $WMR_COREML_SD_COMPUTE_UNITS (all / cpu_gpu / cpu_ane / cpu) overrides the compute unit.

2. CPU sdcpp SDXL (Linux, Windows, macOS Intel)

Used by --synthid-attack regen on Linux, Windows, and macOS Intel, and by --regen-backend cpu everywhere. Run natively via leejet/stable-diffusion.cpp (ggml), CPU-only in the release binaries.

sd_xl_base_1.0.safetensors is the official Stability AI SDXL base 1.0 checkpoint (unchanged bytes; its SHA is the HuggingFace LFS content oid, so it verifies identically to the upstream file). sdxl_vae.safetensors is the fp16-stable VAE from madebyollin/sdxl-vae-fp16-fix.

Licenses

• SDXL base 1.0: CreativeML Open RAIL++-M (stabilityai/stable-diffusion-xl-base-1.0)
• VAE fp16-fix: MIT (madebyollin/sdxl-vae-fp16-fix)
• Conversion tool: MIT (apple/ml-stable-diffusion)